Policy
Attaches a Managed IAM Policy to user(s), role(s), and/or group(s) !>WARNING: The aws.iam.PolicyAttachment resource creates exclusive attachments of IAM policies. Across the entire AWS account, all of the users/roles/groups to which a single policy is attached must be declared by a single aws.iam.PolicyAttachment resource. This means that even any users/roles/groups that have the attached policy via any other mechanism (including other resources managed by this provider) will have that attached policy revoked by this resource. Consider aws.iam.RolePolicyAttachment, aws.iam.UserPolicyAttachment, or aws.iam.GroupPolicyAttachment instead. These resources do not enforce exclusive attachment of an IAM policy.
NOTE: The usage of this resource conflicts with the
aws.iam.GroupPolicyAttachment,aws.iam.RolePolicyAttachment, andaws.iam.UserPolicyAttachmentresources and will permanently show a difference if both are defined. NOTE: For a given role, this resource is incompatible with using theaws.iam.Roleresourcemanaged_policy_arnsargument. When using that argument and this resource, both will attempt to manage the role's managed policy attachments and the provider will show a permanent difference.
Example Usage
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.iam.User;
import com.pulumi.aws.iam.Role;
import com.pulumi.aws.iam.RoleArgs;
import com.pulumi.aws.iam.Group;
import com.pulumi.aws.iam.Policy;
import com.pulumi.aws.iam.PolicyArgs;
import com.pulumi.aws.iam.PolicyAttachment;
import com.pulumi.aws.iam.PolicyAttachmentArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var user = new User("user");
var role = new Role("role", RoleArgs.builder()
.assumeRolePolicy("""
{
"Version": "2012-10-17",
"Statement": [
{
"Action": "sts:AssumeRole",
"Principal": {
"Service": "ec2.amazonaws.com"
},
"Effect": "Allow",
"Sid": ""
}
]
}
""")
.build());
var group = new Group("group");
var policy = new Policy("policy", PolicyArgs.builder()
.description("A test policy")
.policy("""
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"ec2:Describe*"
],
"Effect": "Allow",
"Resource": "*"
}
]
}
""")
.build());
var test_attach = new PolicyAttachment("test-attach", PolicyAttachmentArgs.builder()
.users(user.name())
.roles(role.name())
.groups(group.name())
.policyArn(policy.arn())
.build());
}
}